Hi,
I'm working on adding certificates to overrides and came across some
issues with the local overrides. The main cause was that instead you
searching the original object in the cache, the DN of the object was
constructed. This failed for users form sub-domain which have the
fully-qualified name in the DN and not only the short name. Additionally
users with mixed-case names where not found in case-insensitive domains
which can e.g. with the AD provider and the Administrator user from AD.
The first patch contains a new integration test which tests the
mixed-case user name. Unfortunately it is currently not possible to test
the sub-domain case.
The second patch replaces the DN based lookup with a proper search. Imo
calls like sysdb_user_dn() to construct a DN should only be used when
adding new entries but newer to look up entries. Here always proper
searches should be used. And as long as the search uses index attributes
it will not be much more expensive than the DN based lookup because
afaik the ldb index tables are kept in memory.
The third patch makes sure that the tools are aware of the flat name and
the SID of the master domain if this information is available in the
cache. This might currently not be needed explicitly but helps to avoid
some irritating debug messages about a missing flat name when generating
fully qualified names.
Finally the last patch fixes the output of sub-domain users which
already have a fully-qualified name where no additional domain component
must be added.
bye,
Sumit
Show replies by date